Skip to content

Commit

Permalink
refactor actor_user function to use imported deep_get
Browse files Browse the repository at this point in the history
  • Loading branch information
ben-githubs committed Nov 7, 2024
1 parent b3ec513 commit 39ce4ae
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions global_helpers/panther_azuresignin_helpers.py
Original file line number Diff line number Diff line change
@@ -1,9 +1,14 @@
from panther_base_helpers import deep_get


def actor_user(event):
# 'event' could be a PantherEvent or an ImmutableCaseInsensitiveDict, so we have to use the
# imported deep_get method.
category = event.get("category", "")
if category in {"ServicePrincipalSignInLogs"}:
return event.deep_get("properties", "servicePrincipalName")
return deep_get(event, "properties", "servicePrincipalName")
if category in {"SignInLogs", "NonInteractiveUserSignInLogs"}:
return event.deep_get("properties", "userPrincipalName")
return deep_get(event, "properties", "userPrincipalName")
return None


Expand Down

0 comments on commit 39ce4ae

Please sign in to comment.